Re: [cobalt-users] SMTP hole maybe - any ideas

[Andreas Banze <andreas@xxxxxxxx>]

On Wed Jun 04, 2003 - 10:46:03AM, Ian wrote:

> Came across what seems like a weird exploit, which I am not sure is across
> all, or just generic to us.

not an exploit, merely an misunderstanding

> If we send an email to an email address that is located on our raq3 and
> send it from another email address that is also on the same raq3, then it
> is relayed without any prevention what so ever and without any POP3
> account being polled as per the pop b4 smtp system.

yes, this is correct. 
fetchmail (the program that is used to get the mail from the pop3-account)
feeds the received mails to the local smtp mailer. To be able to deliver the
mails the local smtp mailer needs to know how to reach the recipients. This
pop3-polling is meant for people behind dialin lines who are not constantly
online (a smtp server that receives mail and therefore is mentioned in a dns
entry needs to be online 24h a day). Because your raq3 determindes that the
recipient is "local" it doesn't need to send the mail to another server (it
even doesn't know there is another one - at least the smtp-server). For your
server there is noone else responsible for the local domains. the
pop3-fetchmail is merely a hack to get around the quirks of not having a
leased line and therefore trick the smtp server.

Unless you did some nifty things with packet filters or alike your server
will therefore be able to receive mails sent to him per smtp and honour the
relay rules that are configured (basically: if you know either the sender or
the recipient relay mail - sender is normally not determined by email
address).

> It seems that if a person knows of domains on a server, they could send
> emails purporting to come from other users on the ssame server without any
> problem what so ever.

That's how it works everywhere - as long as the server determines that he is
responsible for the recipients he will not care about the sender and the
sender may be forged as well. You want to tell sendmail not to accept
smtp-connections from other hosts except localhost to prevent that from
happening (no, sorry, I don't know how to achieve this on a raq/qube - my
raq2's run with netbsd) but this would prevent you from using your raq3 for
sending mail from your office as well.

> Anyone heard of this before and can they do it maybe....

Hmmm... read something about the basics of mailservers on unix systems
including sendmail and fetchmail?

MfG
Andreas Banze

--
There are two means of refuge from the miseries of life: music and cats.
					-- Albert Schweitzer